Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,698 downloads10,515 copies160 likes57,270 views
8,654 detections
Filters
Last updated
All Time
Detection languages
5,826
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects a suspicious sequence of events where a user performs an unusual device-code authentication (potentially indicative of device code phishing) followed shortly by an OAuth application consent or permission grant event. It flags potential compromise if the sign-in is new for the user or occurs in a short timeframe, with optional indicators associated with the 'maillive.sbs' phishing infrastructure.
This rule monitors network traffic from CommonSecurityLog data to detect bidirectional communication between NetScaler appliances and known malicious infrastructure associated with the CVE-2026-88772 campaign, which is indicative of command-and-control activity.
This rule identifies installations of TeamViewer software that are vulnerable to specific CVEs (CVE-2026-19743, CVE-2026-92368, CVE-2026-92369, CVE-2026-92370, CVE-2026-92371) by analyzing the 'DeviceTvmSoftwareInventory' dataset. It checks for versioning patterns against known vulnerable build numbers across Windows, Linux, and macOS platforms to pinpoint systems requiring patching.
This rule detects HTTP POST requests targeting Adobe Commerce or Magento checkout, customer, or admin endpoints that contain suspicious syntax patterns indicative of Server-Side Template Injection (SSTI). These patterns ({{...}}, {%...%}, ${...}) are common in various template engines and, when injected into application inputs, can lead to Remote Code Execution (RCE) via CVE-2026-75650.
Detects attempts to exploit CVE-2026-83549 in SonicWall SMA1000 appliances, where an attacker sends a malicious HTTP request to the 'workplace' URI containing shell metacharacters such as ';', '|', '`', or '$(' to execute arbitrary OS commands.
This rule detects a potential heap overflow exploitation attempt against F5 BIG-IP Access Policy Manager (APM) by inspecting HTTP POST requests to the /oauth/token endpoint with an unusually large 'grant_type' field (exceeding 4096 bytes). This behavior is characteristic of an attempt to trigger the heap overflow vulnerability identified as CVE-2026-94127.
Detects the execution of MSP360 or generic RMM-labeled binaries originating from common user download directories (Downloads or Temp folders) when the filename mimics common phishing lures such as invoice, e-card, RSVP, or document-related naming conventions. This activity indicates a potential social engineering attempt to execute remote monitoring and management tools.
Detects attempts to disable or tamper with Microsoft Windows Defender via registry modifications or malicious PowerShell/reg.exe commands, specifically targeting security settings like DisableAntiSpyware, DisableRealtimeMonitoring, and exclusion paths.
Detects modifications to Microsoft Entra ID (formerly Azure AD) authentication policies, specifically the registration, enablement, or modification of External Authentication Methods (EAMs). This activity can indicate an attempt to add a rogue authentication provider for persistent unauthorized access, bypassing standard MFA or conditional access policies.
This rule detects anomalous activity associated with the Antino backdoor, which uses Microsoft OneDrive as a dead-drop command-and-control (C2) channel. It identifies specific file paths related to heartbeat check-ins, operator tool drops, and exfiltration retrieval, summarizing events by user and IP to highlight potential malicious persistent communication and data transfer patterns.
Page 9 of 866